Ryfujk

Did Mueller's report provide an evidentiary basis for the claim of Russian govt election interference via social media?

Trademark violation for app?

How does light 'choose' between wave and particle behaviour?

How can I prevent/balance waiting and turtling as a response to cooldown mechanics

What's the point of the test set?

Is there public access to the Meteor Crater in Arizona?

Is multiple magic items in one inherently imbalanced?

Did any compiler fully use 80-bit floating point?

Converted a Scalar function to a TVF function for parallel execution-Still running in Serial mode

Most bit efficient text communication method?

How many time has Arya actually used Needle?

What order were files/directories output in dir?

Would it be easier to apply for a UK visa if there is a host family to sponsor for you in going there?

What do you call the main part of a joke?

Why weren't discrete x86 CPUs ever used in game hardware?

How do I find out the mythology and history of my Fortress?

What initially awakened the Balrog?

Antipodal Land Area Calculation

What does this say in Elvish?

Can the Flaming Sphere spell be rammed into multiple Tiny creatures that are in the same 5-foot square?

Why do early math courses focus on the cross sections of a cone and not on other 3D objects?

Putting class ranking in CV, but against dept guidelines

Girl Hackers - Logic Puzzle

Why are vacuum tubes still used in amateur radios?

monitoring/troubleshooting aws rds high cpu usage

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

0

I have an RDS instance running and it uses an average of 20-30% cpu utilization. Last night it spiked up to 80% for a few minutes and I am trying to figure out why. Error logs show nothing, and I have no setup for any other kind of log on parameter groups (just default).
I tried running

show full processlist;

but I don't know if some specific process triggered at the time of the spike.

mysql amazon-web-services monitoring amazon-rds

share|improve this question

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

0

I have an RDS instance running and it uses an average of 20-30% cpu utilization. Last night it spiked up to 80% for a few minutes and I am trying to figure out why. Error logs show nothing, and I have no setup for any other kind of log on parameter groups (just default).
I tried running

show full processlist;

but I don't know if some specific process triggered at the time of the spike.

mysql amazon-web-services monitoring amazon-rds

share|improve this question

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

I have an RDS instance running and it uses an average of 20-30% cpu utilization. Last night it spiked up to 80% for a few minutes and I am trying to figure out why. Error logs show nothing, and I have no setup for any other kind of log on parameter groups (just default).
I tried running

show full processlist;

but I don't know if some specific process triggered at the time of the spike.

mysql amazon-web-services monitoring amazon-rds

share|improve this question

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

show full processlist;

share|improve this question

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

share|improve this question

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

asked Apr 19 '18 at 22:20

Simon Ernesto Cardenas ZarateSimon Ernesto Cardenas Zarate

161110

1 Answer
1

active

oldest

votes

0

Having no audit logs reduces significantly the potential of a forensic analysis, and the issue is so common and generic that there is no rule-of-thumb that can help. Your only choice in this situation is to evaluate the other available RDS metrics and correlate the information with the applications that make use of your DB instance.

First of all, you should try to match the incident with the usage of your applications or the activity of interactive human users. Typically, these kind of incidents are derived of a spike in client application's load or users doing things without full knowledge of their impact.

Do you experience any DBConnections spike during the incidence? If so, does it make sense if such spike in connections come from an unexpected traffic (supposing that your DB is the data source of an exposed web application)? If that is the case, most surely your issue is related to security in the frontend layer and not in the DB itself.

Does the Read or Write IO increase during the incident? If so, that may imply that memory resources are insufficient to handle your application load during certain conditions. Also, it could mean that you have missing indexes or inefficient queries that load your instance unnecesarily. The MySQL EXPLAIN command should help here.

I would recommend you to ensure the performance_schema is enabled and deploy the sys schema to enable the MySQL Workbench performance tools, it helps a lot to detect schema and query bottlenecks.

Also, the Audit Log available through RDS OptionGroups and relaying it to Cloudwatch Logs (with a proper retention period) could help a lot in the future to investigate what the hell your applications (or users) are doing with the database. "show processlist" is only useful when used at the moment of the incident as it is a runtime tool.

share|improve this answer

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f908596%2fmonitoring-troubleshooting-aws-rds-high-cpu-usage%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

Having no audit logs reduces significantly the potential of a forensic analysis, and the issue is so common and generic that there is no rule-of-thumb that can help. Your only choice in this situation is to evaluate the other available RDS metrics and correlate the information with the applications that make use of your DB instance.

First of all, you should try to match the incident with the usage of your applications or the activity of interactive human users. Typically, these kind of incidents are derived of a spike in client application's load or users doing things without full knowledge of their impact.

Do you experience any DBConnections spike during the incidence? If so, does it make sense if such spike in connections come from an unexpected traffic (supposing that your DB is the data source of an exposed web application)? If that is the case, most surely your issue is related to security in the frontend layer and not in the DB itself.

Does the Read or Write IO increase during the incident? If so, that may imply that memory resources are insufficient to handle your application load during certain conditions. Also, it could mean that you have missing indexes or inefficient queries that load your instance unnecesarily. The MySQL EXPLAIN command should help here.

I would recommend you to ensure the performance_schema is enabled and deploy the sys schema to enable the MySQL Workbench performance tools, it helps a lot to detect schema and query bottlenecks.

Also, the Audit Log available through RDS OptionGroups and relaying it to Cloudwatch Logs (with a proper retention period) could help a lot in the future to investigate what the hell your applications (or users) are doing with the database. "show processlist" is only useful when used at the moment of the incident as it is a runtime tool.

share|improve this answer

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

add a comment | 

0

Having no audit logs reduces significantly the potential of a forensic analysis, and the issue is so common and generic that there is no rule-of-thumb that can help. Your only choice in this situation is to evaluate the other available RDS metrics and correlate the information with the applications that make use of your DB instance.

First of all, you should try to match the incident with the usage of your applications or the activity of interactive human users. Typically, these kind of incidents are derived of a spike in client application's load or users doing things without full knowledge of their impact.

Do you experience any DBConnections spike during the incidence? If so, does it make sense if such spike in connections come from an unexpected traffic (supposing that your DB is the data source of an exposed web application)? If that is the case, most surely your issue is related to security in the frontend layer and not in the DB itself.

Does the Read or Write IO increase during the incident? If so, that may imply that memory resources are insufficient to handle your application load during certain conditions. Also, it could mean that you have missing indexes or inefficient queries that load your instance unnecesarily. The MySQL EXPLAIN command should help here.

I would recommend you to ensure the performance_schema is enabled and deploy the sys schema to enable the MySQL Workbench performance tools, it helps a lot to detect schema and query bottlenecks.

Also, the Audit Log available through RDS OptionGroups and relaying it to Cloudwatch Logs (with a proper retention period) could help a lot in the future to investigate what the hell your applications (or users) are doing with the database. "show processlist" is only useful when used at the moment of the incident as it is a runtime tool.

share|improve this answer

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

add a comment | 

Having no audit logs reduces significantly the potential of a forensic analysis, and the issue is so common and generic that there is no rule-of-thumb that can help. Your only choice in this situation is to evaluate the other available RDS metrics and correlate the information with the applications that make use of your DB instance.

First of all, you should try to match the incident with the usage of your applications or the activity of interactive human users. Typically, these kind of incidents are derived of a spike in client application's load or users doing things without full knowledge of their impact.

Do you experience any DBConnections spike during the incidence? If so, does it make sense if such spike in connections come from an unexpected traffic (supposing that your DB is the data source of an exposed web application)? If that is the case, most surely your issue is related to security in the frontend layer and not in the DB itself.

Does the Read or Write IO increase during the incident? If so, that may imply that memory resources are insufficient to handle your application load during certain conditions. Also, it could mean that you have missing indexes or inefficient queries that load your instance unnecesarily. The MySQL EXPLAIN command should help here.

I would recommend you to ensure the performance_schema is enabled and deploy the sys schema to enable the MySQL Workbench performance tools, it helps a lot to detect schema and query bottlenecks.

Also, the Audit Log available through RDS OptionGroups and relaying it to Cloudwatch Logs (with a proper retention period) could help a lot in the future to investigate what the hell your applications (or users) are doing with the database. "show processlist" is only useful when used at the moment of the incident as it is a runtime tool.

share|improve this answer

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

share|improve this answer

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413

answered Apr 19 '18 at 23:08

ma.tomema.tome

1,049413